)]}'
{"specs/keystone/pike/api-implemetation-required-to-download-identity-policies.rst":[{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"ce35fa04b14269e94537c180480f78ab45aa7c46","unresolved":false,"context_lines":[{"line_number":37,"context_line":"For example - "},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"CURL command - "},{"line_number":40,"context_line":"\tcurl -s -H \"X-Auth-Token: $OS_TOKEN\" http://my-controller/identity_admin/v3/policy"},{"line_number":41,"context_line":"OUTPUT - "},{"line_number":42,"context_line":"\t"},{"line_number":43,"context_line":"{\"identity:list_endpoints\": \"rule:admin_required\", \"identity:update_endpoint\": \"rule:admin_required\","}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f013ff3_158844c4","line":40,"range":{"start_line":40,"start_character":77,"end_line":40,"end_character":83},"updated":"2017-05-12 20:45:01.000000000","message":"We also have a /v3/policies API. Adding this will make it confusing as to what is used for what. https://developer.openstack.org/api-ref/identity/v3/index.html#policies","commit_id":"5c11868b45ed7f4f2a153c96efa60a4b5340e779"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"ce35fa04b14269e94537c180480f78ab45aa7c46","unresolved":false,"context_lines":[{"line_number":40,"context_line":"\tcurl -s -H \"X-Auth-Token: $OS_TOKEN\" http://my-controller/identity_admin/v3/policy"},{"line_number":41,"context_line":"OUTPUT - "},{"line_number":42,"context_line":"\t"},{"line_number":43,"context_line":"{\"identity:list_endpoints\": \"rule:admin_required\", \"identity:update_endpoint\": \"rule:admin_required\","},{"line_number":44,"context_line":"\"admin_or_token_subject\": \"rule:admin_required or rule:token_subject\","},{"line_number":45,"context_line":"\"token_subject\": \"user_id:%(target.token.user_id)s\", \"identity:create_service\":"},{"line_number":46,"context_line":"\"rule:admin_required\", \"identity:get_region\": \"\", \"identity:create_endpoint\": \"rule:admin_required\","},{"line_number":47,"context_line":"\"admin_or_owner\": \"rule:admin_required or rule:owner\", \"owner\": \"user_id:%(user_id)s\","},{"line_number":48,"context_line":"\"identity:update_region\": \"rule:admin_required\", \"identity:get_endpoint\": \"rule:admin_required\","},{"line_number":49,"context_line":"\"admin_required\": \"role:admin or is_admin:1\", \"identity:list_regions\": \"\","},{"line_number":50,"context_line":"\"identity:update_service\": \"rule:admin_required\","},{"line_number":51,"context_line":"\"service_admin_or_token_subject\": \"rule:service_or_admin or rule:token_subject\","},{"line_number":52,"context_line":"\"default\": \"rule:admin_required\", \"identity:delete_service\": \"rule:admin_required\","},{"line_number":53,"context_line":"\"identity:create_region\": \"rule:admin_required\", \"identity:get_service\": \"rule:admin_required\","},{"line_number":54,"context_line":"\"service_role\": \"role:service\", \"identity:list_services\": \"rule:admin_required\","},{"line_number":55,"context_line":"\"service_or_admin\": \"rule:admin_required or rule:service_role\","},{"line_number":56,"context_line":"\"identity:delete_region\": \"rule:admin_required\", \"identity:delete_endpoint\": \"rule:admin_required\"}"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"For this I have proposed this gerrit link - "},{"line_number":59,"context_line":"https://review.openstack.org/463543"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f013ff3_b5a75050","line":56,"range":{"start_line":43,"start_character":0,"end_line":56,"end_character":99},"updated":"2017-05-12 20:45:01.000000000","message":"This isn\u0027t the standard format of the json we return in our other APIs. The python-keystoneclient will want you to have this inside of a dictionary key, like: { \"policies\": { }}","commit_id":"5c11868b45ed7f4f2a153c96efa60a4b5340e779"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"ce35fa04b14269e94537c180480f78ab45aa7c46","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Security Impact"},{"line_number":67,"context_line":"---------------"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"None"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Notifications Impact"},{"line_number":72,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f013ff3_75c2e8eb","line":69,"range":{"start_line":69,"start_character":0,"end_line":69,"end_character":4},"updated":"2017-05-12 20:45:01.000000000","message":"This has a security impact since anyone with an admin token can now download the entire policy file. This should be noted in this section.","commit_id":"5c11868b45ed7f4f2a153c96efa60a4b5340e779"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bccfb15b072c7f4d3c3429209d07f6339a4aa32c","unresolved":false,"context_lines":[{"line_number":27,"context_line":"deployments. It requires policy.json files for each component to verify"},{"line_number":28,"context_line":"against. With the components moving towards oslo.policy for implementing"},{"line_number":29,"context_line":"policy rules, there should be a mechanism to download the policies that"},{"line_number":30,"context_line":"are enforced."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed Change"},{"line_number":33,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1f013ff3_fc07c51b","line":30,"updated":"2017-05-16 14:25:31.000000000","message":"This statement makes it seem like Patrole is the thing evaluating and enforcing policy, is that correct? Has this been implemented in any of the other services yet? We have tooling available in oslo.policy to generate sample and hybrid policy files based on overrides, which sounds like it might solve this use case (but I need to understand how Patrole is using policy first).\n\nWe try to keep policy away from users of the system since it\u0027s an operator thing.","commit_id":"eb1c780aee3ea304bef317737543f4e78d5b0c23"},{"author":{"_account_id":8205,"name":"Mh Raies","email":"raiesmh08@gmail.com","username":"raiesmh08"},"change_message_id":"5b958b3a45925af3ac6a91ac84bbe87842e4ee5f","unresolved":false,"context_lines":[{"line_number":27,"context_line":"deployments. It requires policy.json files for each component to verify"},{"line_number":28,"context_line":"against. With the components moving towards oslo.policy for implementing"},{"line_number":29,"context_line":"policy rules, there should be a mechanism to download the policies that"},{"line_number":30,"context_line":"are enforced."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed Change"},{"line_number":33,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1f013ff3_72b519cd","line":30,"in_reply_to":"1f013ff3_c72b16e9","updated":"2017-05-16 17:19:08.000000000","message":"Lance,\nI have been working on Patrole since long, here is how it uses policy (Forgot mention that) - \nhttps://github.com/openstack/patrole/blob/master/patrole_tempest_plugin/rbac_policy_parser.py#L101\n\nIn this way, If Patrole node is a remote node (other than controller) it will always check/assume for policy.json file on remote machine. Because oslo_policy is not available to remote. \nIn this way Spec proposal comes.","commit_id":"eb1c780aee3ea304bef317737543f4e78d5b0c23"},{"author":{"_account_id":8205,"name":"Mh Raies","email":"raiesmh08@gmail.com","username":"raiesmh08"},"change_message_id":"559b9bc41857948ba2f96e286b536ac7721d1bb7","unresolved":false,"context_lines":[{"line_number":27,"context_line":"deployments. It requires policy.json files for each component to verify"},{"line_number":28,"context_line":"against. With the components moving towards oslo.policy for implementing"},{"line_number":29,"context_line":"policy rules, there should be a mechanism to download the policies that"},{"line_number":30,"context_line":"are enforced."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Proposed Change"},{"line_number":33,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1f013ff3_c72b16e9","line":30,"in_reply_to":"1f013ff3_fc07c51b","updated":"2017-05-16 14:42:53.000000000","message":"Lance,\nOpenStack Patrole is a Tempest plugin to check if policies are correctly enforced or not.\nIt does not enforce policies instead it check if they are correctly enforced. For more details you can check - https://github.com/openstack/patrole\nPlease find answers for your questions here -\na. We have registered this blueprint in each component and started with Keystone. So Keystone is the first component we have started with spec and implementation.\nb. Yes you are right that overriding tooling is available but it can be done from the OpenStack node (Controller node)only. As being a tempest plugin it must have a capability to evaluate polices (in code or file) from a non OpenStack remote machine node. \nSolution for this can be to copy-paste policy files from openstack controller node to non OpenStack node remote node. This is very odd. So best solution seems to provide an admin restricted policy rule download API.\n\nFor any other queries, feel free to ask.","commit_id":"eb1c780aee3ea304bef317737543f4e78d5b0c23"}]}